Order and platform rules

The platform has four primary roles: customer, support, programmer, and administrator. Authentication does not itself grant project access. Server-side role checks, project membership, task assignment and explicit approvals determine what a person may view or change. Administrators manage sensitive commercial and access decisions; support verifies order completeness and proposes adjustments; programmers work only on approved assignments.

Support may clarify answers and recommend changes but may not silently change the approved scope. A material proposal pauses affected work until customer approval. Material means a price change of at least both 10% and €250, a delay over five business days, or a change to a core deliverable or licence. Support may classify documented minor corrections as nonmaterial.

AI may turn the approved project into proposed work chunks using only the minimum relevant, redacted order information or code. Support must verify the proposal before it becomes an assignment. Customers see broad progress labels and appropriate preview links, not private implementation subtasks, secrets, unrestricted repositories, or programmer compensation details.

GitHub is the intended version-control system. Repository visibility or write access requires an approved project assignment and may be removed when the need ends. CODEOWNERS, branch protection, review, short-lived credentials where available, and audit logs are intended safeguards; they do not guarantee directory-level read isolation inside one repository. Programmers may request broader access, but an authorised reviewer must approve it.

Verified contractors are intended to receive a fixed amount for each task after support approval and the applicable quality hold. German employees must instead be handled through compliant payroll; task amounts may be internal costing or bonuses, not a substitute for employee-law obligations. Final contracts and status determinations remain required.

Customers must provide information they are authorised to use, answer scope questions honestly, respond to approvals, and avoid unlawful, infringing, malicious, or secret material that is not needed for the project. Images, PDF and DOCX are the planned upload formats, limited to 25 MB each and 50 MB total per order.

Krill does not promise antivirus scanning. Planned server-side MIME, magic-byte or signature, size and access checks reduce risk but cannot prove a file is harmless. Files may be rejected, quarantined from preview, or require replacement when validation fails.

Sensitive actions are intended to be server-authorised, validated, rate-limited and logged. Logs should identify actor, action, target and time without recording passwords, OTPs, secrets or unnecessary personal content. Access can be suspended for security, legal, payment, approval, or project-integrity reasons, subject to applicable contract and consumer law.